# Execution materials and history maintenance

Version 0.5.0 selectively adapts portable contracts observed in the installed CAW 1.2 artifact. Exact source hashes are recorded in `upstream.json`; this is not a claim that the upstream package version or Git commit changed. Existing portable source graphs, resource hashes, model selections and Run pins remain immutable.

Version 0.5.1 additionally fences automatic maintenance startup across foreground/receipt reads when the manager closes. A queued request does not allocate a listener, claim or worker after losing that authority; genuine ownership and filesystem failures remain visible.

## Complete node inputs

The Host prepares exact projected values before creating any item task. Every input has a complete UTF-8 or canonical-JSON sidecar and a hash-bound manifest under that Run's private execution material directory. Unpaired Unicode surrogates use canonical JSON to preserve the semantic string. Nodes receive only their assigned item resources. Values larger than 8 KiB spill as whole fields; inline input values and source resource catalog share a 12,000-byte aggregate budget. The complete serialized input index plus catalog is at most 16,000 bytes, including escaping and reference metadata. An irreducibly large index or catalog becomes another complete pinned resource. No value is shortened or silently discarded.

Models read material references through existing immutable resource tools, including `read_workflow_resource_chunk`. Follow `next_byte` exactly until `complete`; decode canonical JSON as declared. Host-prepared materials have an explicit 16 MiB per-file and 64 MiB per-task aggregate admission limit; source resource limits remain unchanged. Incremental deliveries share identical content pins within one assigned task. Logical resource references confer no workspace write authority. Exact preparation is idempotent, and existing different bytes cause `PI_INPUT_MATERIAL_CONFLICT` while retaining evidence. Executor events link the manifest, semantic input hash and complete submitted prompt hash/byte count.

The legacy local `global.max_prompt_chars` setting now bounds complete UTF-8 prompt bytes, default 80,000. The final dispatch marker, task instructions, scope, inputs, catalog, shared-prefix metadata, correction text and result schema all count. Instructions or schema that still exceed this budget fail visibly with `PI_PROMPT_LIMIT` before model delivery; they are not truncated. This controls the task message, not the provider's entire context window, tool schemas or existing orchestration chat history.

Declared shared inputs must be canonically equal **after each item projection**, including structured arrays inside JSON-string bindings. Referenced task/context/verification template fields must explicitly be common. Pi preserves independent item sessions and records `transport_cache:false`; no common model fork or prompt-cache reuse is promised.

## Native programs and output

Native broker instances allocate a unique sealed temporary leaf and set TEMP/TMP/TMPDIR to it. Allocation and launch are fenced by close; quiescence validates physical ownership before cleanup. The WSL execution adapter retains its existing sandbox contract.

Model-facing program replies are bounded to 32 KiB of serialized UTF-8, including escaping. Complete stdout/stderr bytes live in a sealed private spool, with an explicit 64 MiB combined disk cap and stream hash/size/outcome evidence. `read_program_output` returns exact continuations, including base64 for arbitrary bytes. Success and nonzero exits retain the same complete diagnostics. Mechanical capture/disk/ownership errors remain visible and do not repair a poisoned execution queue. Internal resource-program Host operations use `programOutputMode:'actual'` and retain their existing 1 MiB structured-operation limit.

Run/Role task spools persist after task quiescence under exact private material roots. Runs retain them until an exact terminal summary authorizes trimming. Successful Roles save their result and confirm shutdown before preparing hash-bound material and transcript deletion intents. Failed, uncertain or tampered ownership retains diagnostic evidence. Default standalone brokers may retire their ephemeral spool after verified quiescence.

## Storage admission and maintenance

Short Run journal transactions use bounded ordered cross-process admission, retaining the existing canonical per-Run writer lock. Never hold these tickets across model calls, programs or other execution effects. Live/unknown owner claims block rather than being taken over. Exact orphan inspection/recovery is explicit. Same-Run reads reenter their transaction; cross-Run reads inside a transaction remain read-only snapshots to avoid child/ancestor lock inversion.

Owned claim retirement atomically renames the verified canonical file to a unique private retired leaf and deletes only that leaf. It checks physical identity and original bytes and cannot delete a successor claim. Windows delete-pending waits are bounded and limited to the exact owned leaf. Failures retain bounded locators and compound error evidence; there is no blanket EPERM retry or effect replay.

One shared maintenance manager per Host storage root coalesces automatic requests. A credential-free filesystem worker performs bounded history scans and prepared deletion. Foreground journal activity defers or cancels automatic work. The Host keeps execution quiescence, parent/child, detached-owner and bridge checks plus durable retained results/deletion intents. Manual cleanup awaits its own request and policy. `run_retention` exposes maintenance phase/outcome/owner diagnostics. Shutdown is bounded; unconfirmed workers retain their claim, and automatic maintenance does not take over orphan writers. Reserved `.pending` and `.admission-queue` evidence survives trimming. The detached journal monitor yields terminal publication to an active driver and rechecks admission after asynchronous reads/enrichment, preserving one original event/delivery identity without suppressing later distinct authoring events.

Offline tests cover projected large input fidelity, final prompt budgets, exact spool reconstruction and ownership, real cross-process admission, native retirement, coalesced/deferred/cancelled maintenance and material cleanup. Real provider billing, remote MCP OAuth and universal Windows process cancellation are outside that proof. The unchanged finite-parent acceptance test also exposes a preexisting local Windows limitation: taskkill can return exit 128 with an unsupported-operation diagnostic, and an effect can occur after revocation while shutdown is unconfirmed. A failed helper remains `PI_EXECUTION_STOP_UNCONFIRMED` even if the parent subsequently exits. The existing natural-parent-exit path also does not establish exact Windows Job tree ownership. The helper has a five-second deadline, bounded diagnostics and confirmed helper closure. Establishing exact Job ownership before launch requires a separate launcher change; this version does not claim that capability or weaken its acceptance test.